The Rosetta Stone, with Its Seams Shown.

The essential property transfers exactly, and it is the property federal programs most often lack. Both are a single named person with authority to accept risk, and both are the reason subordinates can act without asking first. Risk acceptance that is owned by a committee is risk acceptance nobody performs, and a defense whose every action needs a meeting has no commander regardless of the org chart.

The test survives the translation intact and is the most useful thing on this row. Intent has to be actionable when the plan has already failed — which disqualifies “reduce cyber risk” for exactly the reason it disqualifies “attack effectively”. A defensive intent that cannot settle an argument at 03:00 between availability and containment is a mission statement wearing the word.

The sequence is the content, in both domains, and both are wrong when read as a menu. A scheme that names all eleven forms has designated nothing, in the same way that a plan which tasks every unit to the decisive point has planned nothing. The borrowing also imports the right unit of work: leaders choose intent and sequence, engineers choose technique, and the plan survives the tool churn that would invalidate a technique-level plan within a year.

Control versus value is the distinction that makes the whole borrowing worthwhile, and it is invisible in the vocabulary that federal programs otherwise use. An asset can be extremely valuable and not be key terrain — a large archive nobody can move through. An asset can be nearly worthless and be key terrain — a build agent with a deployment credential. A criticality register ranks the first kind and misses the second entirely, which is how estates get taken through systems that were never on the list.

Leverage rather than importance is the right test and it survives translation without damage. It also produces a usefully short list: an estate has thousands of important systems and a handful of points where one action changes everything downstream, and naming the handful is what lets a defense concentrate at all.

Countability is what transfers, and it is the correction the term exists to make. An attack surface is everything exposed and produces a number nobody can act on; an avenue is a specific route to a specific objective and produces a short list you can site defensive moves on. Doctrine’s further insistence — that an avenue is assessed for where it can be *observed* as well as blocked — is the part that stops the list becoming a blocking exercise.

Keeping corridors distinct from avenues is worth the extra word, because the two are defeated by different moves. Avenues are analyzed and blocked at the boundary; corridors are canalised from inside, by microsegmentation and entitlement reduction. Programs that collapse the two spend everything at the perimeter and are surprised by how fast movement is once it starts.

The covered-versus-uncovered rule is the single most useful thing this crosswalk imports, and federal control catalogs have no equivalent of it. An uninstrumented control is a delay, not a defeat; a compliance regime that scores an implemented control and an implemented-and-monitored control identically is systematically overstating the defense by exactly the difference doctrine spent a chapter on.

The word carries a constraint that a priority list does not: there is exactly one. A ranked list of five priorities allocates nothing, because it never says what to give up, and every federal security program has one. Designating a main effort forces the subtraction to be made once, in the open, by the person who owns the risk.

It corrects a real federal pathology. A supporting capability measured on its own metrics — events ingested, agents deployed, uptime — drifts away from the effort it exists to serve and then defends its numbers when challenged. Deriving the supporting effort’s measures from the main effort’s success is the discipline the doctrinal relationship encodes.

The ordering is the entire import, and it diagnoses the commonest federal failure precisely. Programs start at step three — “what are the threats to us?” — and produce a threat assessment with no terrain underneath it, which cannot be used to site anything because it never established what the adversary would be crossing. Running the steps in order also makes the assessment falsifiable: a threat course of action drawn on a real overlay can be wrong in a way that a threat briefing cannot.

The discriminator survives intact and is the most consequential import on this page. Applied honestly it deletes most of what a federal threat-intelligence team is currently asked to produce, because most of it is not tied to any decision anyone will make. It also fixes the direction of travel: requirements flow down from intent, rather than reporting flowing up from whatever the feeds happened to contain.

The clearance apparatus is what makes the borrowing pay. Settling authority in advance is precisely what a federal SOC lacks when it holds a containment action for six hours waiting for somebody to say yes, and the doctrinal framing puts the delay where it belongs — as a command decision about tempo that somebody signed, rather than as an unowned property of the process.

This row transfers without qualification, and it is the only one on the page that does. Everything doctrine asks of a running estimate — continuously maintained, staff-owned, and carrying an explicit judgment about whether the plan still holds rather than only a picture of the world — is exactly what the cyber artifact needs and usually is not. The failure mode is identical in both domains as well: an estimate that records status and never records the judgment has become a status board wearing the word, and in both domains it is discovered at the worst possible moment.

The purpose transfers exactly — under contact you want a selection, not an invention — and so does the distinction between the two, which is habitually collapsed. A branch changes how the current operation is fought; a sequel is what you do next depending on how it ends. Recovery planning is a sequel, and so is exploitation — converting a repelled intrusion into a closed avenue and a new detection. Treating either as a branch is why so many federal response plans stop at containment and have nothing written for the week afterwards.

The two-sided reading transfers and is routinely missed. An intrusion has a culminating point too, and a defense that only has to outlast the adversary’s budget is a different problem from one that has to defeat them — which changes what “winning” means and therefore what to measure. The framing that culmination is a sustainment fact rather than a question of effort or commitment also survives, and it is the right one to bring to a conversation about SOC staffing.

The relativity is the whole import and it is the correction most federal metrics programs need. Four hours to contain is a fine result against an intrusion that took three days and no result at all against one that took twenty minutes; publish the defender’s half alone and tempo gets claimed without ever having been measured. The doctrinal frame also puts the decision back inside the measurement, where most of the delay actually lives and where detection-only metrics never look.

“You cannot have a scheme of maneuver without terrain” is the strongest claim the framework makes, and it holds. A control catalog with no terrain underneath it cannot say what it is defending, which is why control coverage and defensive coverage are different numbers and why only one of them is worth reporting. Keeping the ZTMM pillars unrenamed is the other half: an agency already reporting maturity under M-22-09 does not have to translate to use this.

Reconnaissance as a tasking with an opportunity cost is a far more useful frame than coverage as a percentage. It makes the missing question askable — what did we decide not to see, and against which requirement? — and it puts collection under the intelligence requirement rather than the other way round.

The reason to declare a phase is that it moves cadence and authority, and a program running the same cadence and the same approval path in contact as out of it has not phased anything — it has labeled a slide. Phasing also gives leadership a way to see cyber defense as a campaign with a main effort per stage rather than an undifferentiated permanent grind, which is the presentational problem most federal security briefings actually have.

Naming the escalation path as a *trade* is the contribution, and it is what federal practice is missing. Escalation paths are usually an accident of the org chart, and nobody owns the delay they impose. Written as engagement authority, the delay becomes a decision somebody signed, with a stated reason, reviewable when the reason changes.

The doctrinal insistence that reconstitution is planned and resourced *before* the loss, not improvised after it, is the right frame and it is the one federal continuity planning most often skips. A recovery objective nobody has demonstrated is an aspiration, and doctrine would not accept a regeneration plan whose feasibility had never been tested either.

The separation is worth every bit of the borrowing. Almost all federal security metrics are measures of performance wearing the language of effectiveness: “multifactor coverage at 98%” is a task-completion statement, it is fully compatible with losing, and nothing in the surrounding vocabulary makes that visible. Doctrine has a word for the distinction and a habit of enforcing it.

The reason the layer exists is the doctrinal one: this is ground an adversary attacks *because* it is not defended like the front, and treating it as procurement paperwork rather than as terrain is how a federal estate is taken through a signed update. The doctrinal reading also correctly predicts where the attack lands — at the join, not at the supplier’s front door.

Requiring confidence *and its basis* is the difference between an assessment and an assertion, and it is what makes a wrong call recoverable. A moderate-confidence judgment that turns out wrong is analysis working as designed; a confident one that turns out wrong is a credibility loss the cell does not get back, and the distinction only exists if the level was stated at the time.